Stolen Claude API keys can turn Claude Code into a remote-controlled implant
Darktrace researchers turned Claude Code into a remote-controlled implant in a lab test, steering the coding agent through the memory stores feature of Anthropic’s Claude platform and pulling a 1 GB file out through the Claude Files API. Once the agent was set up, every job and every result traveled through api.anthropic.com, the endpoint the agent already calls for inference, so the attacker’s traffic looked like a coding agent doing its job.
The technique needs a head start. An attacker first has to compromise a developer’s machine and obtain the user’s Claude credentials, which in Darktrace’s scenario were sitting on the device where the user’s tooling had left them. The technique does not rely on a vulnerability in the Claude platform, and the company has not seen it used in the wild.
A shared notebook for commands
Memory stores are collections of text files attached to a Claude Console workspace, built so agents on Anthropic’s Claude Managed Agents service can remember things between sessions. The researchers found that a store can be added to a workspace through the API whether or not the organization uses Managed Agents.
The researchers created a store with three files. Each new Claude Code process wrote a check-in to a heartbeat file, read a job from an input file, carried it out, and posted results to an output file. The operator read the output and wrote the next job. Because the jobs are plain English, the operator can hand over an objective and let the model work out the commands.
Nine jobs, one domain account, a 1 GB file
The test ran on a simulated corporate Active Directory network. A small shell payload found Claude Code on a Linux machine, collected the credentials, and set up a systemd service that kept launching Claude Code processes with the --dangerously-skip-permissions flag, which turns off tool-use confirmation prompts.
The operator then sent nine jobs through the memory store. The agent mapped the local network, pulled employee names and a password from an anonymous FTP share, generated 190 candidate usernames, and sprayed the password at the domain controller and found the account it belonged to. It listed SMB shares with that account, downloaded a 1 GB file, split it into three pieces, and uploaded them to the Files API. The stolen data left the network for Anthropic’s servers. The names and credentials Darktrace published are fictitious.
Other platforms, other keys
Asked whether the pattern carries over to other AI agent platforms, Tim Bazalgette, Chief AI Officer at Darktrace, told Help Net Security: “We tested one platform and haven’t reproduced it elsewhere. The memory stores feature is specific to the Claude platform. The file-upload endpoint we used for exfiltration has an equivalent at OpenAI.”
“The key factor determining exposure is whether the provider’s API exposes services with text storage functionality alongside inference,” he said. “Beyond that, two things matter: how tightly credentials are scoped — here a standard API key reaches memory stores, while OAuth credentials don’t — and whether the customer can see writes to that store at all. None of those are flaws. They’re trade-offs between capability and exposure, worth examining in any agent platform you deploy.”
Darktrace shared the findings with Anthropic before publication, “as a courtesy – no formal disclosure process, because there’s no vulnerability to disclose,” Bazalgette said.
Lock down the keys, then watch the agent
Bazalgette splits the attack in two: getting into the AI system, which is fairly conventional, and using it for command and control and exfiltration once inside. Credentials matter for the first half. “In general, use OAuth or some form of identity federation wherever the platform allows it. Where that isn’t possible, make keys as short-lived as you can, keep their scope narrow, store them securely, and avoid exposing them anywhere they aren’t needed – shell history, dotfiles, environment variables and the like,” he said. “Treat an AI platform key as seriously as a production credential, because it now carries comparable capability.”
An attacker could also hijack an OAuth session, which Bazalgette said is harder to pull off. “And nothing in that second half is disallowed: no vulnerability, no guardrail bypass, no refusal, no malicious software and no strange destination,” Bazalgette said.
Darktrace’s detection advice rests on correlating what agent harness processes launch with the network traffic they generate, then comparing both against a baseline. A Claude Code process that runs tool calls and talks to Anthropic’s API is normal. What should catch your eye is that same process running tool calls with odd command-line arguments, or moving data to and from the API in a ratio that looks nothing like its usual traffic.
“What you’re left with is legitimate actions, through legitimate channels, with legitimate credentials, in a pattern bearing no resemblance to how that agent normally operates,” Bazalgette said. “Approved is not the same as safe, and only behaviour tells you the difference.”
Download: The IT and security field guide to AI adoption
